Analysis
-
max time kernel
68s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20/09/2024, 05:27
General
-
Target
ecec9952b2a9c7e8292f958c9d64e74d_JaffaCakes118.exe
-
Size
245KB
-
MD5
ecec9952b2a9c7e8292f958c9d64e74d
-
SHA1
e9765bcdcbb25591af881cf807285112bab61689
-
SHA256
4908c97e8cec8bcb15200b8be76a5ebe04c5fa82303d3757bc3fb6f08fd5a4d4
-
SHA512
27a33b084c15d8ef33787e9dd6e3255a1369187f53e7e899dd412bf3481f0bb95baa24cd06d8e5e844d99eedf4983b3d8ab1b4e1ba79a761b49b2457d96076b3
-
SSDEEP
6144:KZehg5MuhOA6dHMbRW9sW9UDf5puZdUCHVE2R3y+:hg5Muh+9sWqj5IiMVE2R3y
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 2 IoCs
-
Unexpected DNS network traffic destination 5 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Suspicious use of SetThreadContext 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies WinLogon for persistence
-
C:\Users\Admin\AppData\Local\Temp\ecec9952b2a9c7e8292f958c9d64e74d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ecec9952b2a9c7e8292f958c9d64e74d_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\3a6abd20\X*0*cb*94d81d6b*69.64.52.10:533⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Deletes itself
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29KB
MD51149c1bd71248a9d170e4568fb08df30
SHA16f77f183d65709901f476c5d6eebaed060a495f9
SHA256c2dcf387cb4d218f50463338291e7db38afbdab9aab88fc54e7f9283df1792d1
SHA5129e6eac8facb23b38552d37c9f3cb24098f871d2885ecb3630fcd0199c5600b12a42f095f9fbeb90e5632496491d46fd987660cdda695e92dc386bd482d3ff459
-
Filesize
38KB
MD572de2dadaf875e2fd7614e100419033c
SHA15f17c5330e91a42daa9ff24c4aa602bd1a72bf6e
SHA256c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381
SHA512e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3
-
Filesize
2KB
MD585be798a426fdd8a5a25c3cf73f5bedc
SHA196bb5066e0dfdbe9c528553218f4594f8e1b5e1f
SHA256678ca4989f53d4ae93ba2009766606c7f25a02c16c51a144e91a09580128b2ed
SHA5126771779d6c0f19ca818e9ab75ebf7c2004e62ec48435ed8034021f09b92c7798947260849a84de1c921157f3e3f0a5f95865eb2d362db031624bb45584de5923
-
Filesize
4KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
8KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
32KB
-
Filesize
44KB
-
Filesize
32KB
-
Filesize
44KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
220KB
-
Filesize
344KB
-
Filesize
220KB
-
Filesize
220KB